Evidence: JumpList Automatic Files
Description: Collect JumpList Automatic Files
Category: System
Platform: windows
Short Name: jmplautocol
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
AutomaticDestinations JumpLists track recent documents per application. This data is essential for reconstructing file usage and application activity.
Data Collected
This collector gathers structured data about jumplist automatic files.
Collection Method
This collector walks user JumpList directories, copies .automaticDestinations-ms files, and records file timestamps into jumplist_automatic_collected_files.
Forensic Value
This evidence is crucial for forensic investigations as JumpLists reveal recently used files even after deletion.
